UNC3944

Profile narrative

UNC3944, also tracked as Scattered Spider, is a cybercriminal group referenced in open‑source reporting under both names. The actor has been linked to Russia in some threat‑intelligence assessments, while contemporaneous reporting describes its members as being based in the United States and the United Kingdom. The group is publicly known by the alias UNC3944 and is frequently associated with the Scattered Spider moniker in media coverage. No formal state sponsorship has been demonstrated in the sources provided. The actor’s affiliation with the ransomware operation ALPHV has been noted in connection with specific incidents.

Targeting patterns observed in the attributed incidents include hospitality and gaming enterprises, technology and cloud service providers, and telecommunications and business process outsourcing firms. The group’s activities have affected organizations in North America, with downstream impacts reported in Brazil for a technology distributor. Strategic objectives appear to be financially motivated, as evidenced by ransom demands made against MGM Resorts and the ransomware deployment against ScanSource. The actor’s operations have been described as seeking monetary gain through extortion rather than espionage or pure disruption.

Observed tactics, techniques, and procedures involve the use of ransomware to encrypt systems and halt operations, although specific malware families or initial‑access vectors are not detailed in the available sources. The group has reportedly collaborated with the ALPHV ransomware cartel during the MGM intrusion, suggesting a partnership model for ransomware deployment. Notable campaigns include the August 2023 ransomware attacks on Caesars Entertainment and MGM Resorts, which resulted in system paralysis and a reported ransom payment. Another representative operation is the May 2023 ransomware incident against ScanSource that caused multi‑day outages across its customer portals in North America and Brazil. Earlier activity, as mentioned in reporting, involved targeting telecommunications and business process outsourcing companies, indicating a broader focus on service‑oriented sectors prior to the high‑profile hospitality cases. These examples illustrate the actor’s recurring reliance on ransomware as a means to extract financial compensation from victim organizations.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 4 sources.